feat(kernel): derivation-tree revocation, region caps

- caps record parent (mint/delegate/ipc), CapRef w/ pid+slot gens
- Revoke = delete subtree, keep self; drop/death re-parents children
- CreateRegion/MapRegion; mapping lives only as long as its cap
- drop Permission::Revoke + object-wide revoke
- mint any cap (badge only ep/ntfn), process caps delegable
- kani: descendants == subtree; model-based fuzz vs spec

crates/domain/src/notification/mod.rs

@@ -152,12 +152,6 @@ impl NotificationTable {
         self.generations.current(id.raw() as usize)
     }
 
-    pub fn revoke(&mut self, id: NotificationId) {
-        if self.get(id).is_some() {
-            self.generations.advance(id.raw() as usize);
-        }
-    }
-
     pub fn destroy(&mut self, id: NotificationId) -> Option<Notification> {
         let n = self.slots.get_mut(id.raw() as usize)?.take()?;
         self.generations.advance(id.raw() as usize);